CVE-2019-5108

medium · 6.5

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

6.5

CVSS

10.1%

EPSS (exploit prob.)

95th

EPSS percentile

2019-12-23

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-440CWE-287

Affected products

Vendor	Product	Affected versions
linux	linux_kernel	< 5.3
debian	debian_linux	8.0
debian	debian_linux	9.0
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
netapp	active_iq_unified_manager	all versions
netapp	cloud_backup	all versions
netapp	data_availability_services	all versions
netapp	e-series_santricity_os_controller	>= 11.0.0, <= 11.70.1
netapp	hci_management_node	all versions
netapp	solidfire	all versions
netapp	steelstore_cloud_integrated_storage	all versions
netapp	a700s_firmware	all versions
netapp	a700s	all versions
netapp	h610s_firmware	all versions
netapp	h610s	all versions
netapp	8300_firmware	all versions
netapp	8300	all versions
netapp	8700_firmware	all versions
netapp	8700	all versions
netapp	a400_firmware	all versions
netapp	a400	all versions
oracle	sd-wan_edge	8.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-5108